Law note · Wisconsin
Notice of unauthorized acquisition of personal information
An entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, that knows personal information in its possession has been acquired by an unauthorized person must make reasonable efforts to notify each affected individual within a reasonable time, not to exceed 45 days after learning of the acquisition.
Personal information includes an individual's name combined with, among other elements, a Social Security number, a DNA profile, or unique biometric data such as a fingerprint, voiceprint, or retina or iris image, each on the same footing as the others, with no exclusion anywhere in the section for an identifier derived from a photograph, video, or audio recording. If a single incident requires notifying 1,000 or more individuals, the entity must also notify consumer reporting agencies.
GLBA-compliant and HIPAA-covered entities are exempt outright. The statute's own official annotation states directly that the section does not create a private right of action, citing Fox v. Iowa Health System, 399 F. Supp. 3d 780 (2019).
No separate civil-penalty or forfeiture amount specific to a section 134.98 violation appears within the section itself; Wis. Stat. sec. 134.99 addresses only accomplice or conspirator liability for a chapter violation carrying a forfeiture, without stating the amount or who may bring the action, and this document does not trace the underlying enforcement mechanism further into Wisconsin's general consumer-protection authority under chs. 93 or 100.
What it asks of an app
- Make reasonable efforts to notify each affected Wisconsin individual of an unauthorized acquisition of their personal information within a reasonable time, not to exceed 45 days after learning of it.
- Notify consumer reporting agencies if a single incident requires notifying 1,000 or more individuals.
- Treat a recording-derived voiceprint or faceprint as unique biometric data under this statute. It carries no exclusion for an identifier derived from a photograph, video, or audio recording, unlike the dead AB 466's comprehensive-act-style definition.
- Do not expect an individual to be able to sue you directly for a violation of this section. Its own official annotation states that it creates no private right of action.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_biometrics, processes_voice
Primary source: official Wisconsin statute text, Wis. Stat. sec. 134.98, current through 2025 Wis. Act 247, Wisconsin State Legislature website